🐛 fix: route reporter-trust waits through poller relay

[clubanderson]

Summary

• Keep reporter-trust wait visibility on the github.Client.fetchIssues reporter-trust reject path and share a 10-notice budget across the governor poll
• Route wait comments and needs-triage label mutations through the existing effects-backed comment/label mutation path, with internal write audit records
• Clear only Hive-owned needs-triage labels on the admitted path when the marker proves Hive added the label
• Document the core-poller placement and update the write-surface inventory

label is applied by github.Client.fetchIssues on the reporter-trust reject path, within one poll (≈5 min), no agent involved.

Validation

• gofmt -w / gofmt -l on changed Go files
• git diff --check
• code-reviewer agent: no significant issues found
• Per AGENTS.md, did not run local go test; CI is the verdict

Follow-up to #10537 / #10586.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#10614	✨ dashboard: Audit Log collapsed row shows entry rate, last entry, today's count and sensitive-action chip	same files	src/pkg/dashboard/static/index.html
#10602	✨ feat: label-driven repos skip un-park notice and keep needs-human	same files	src/pkg/dashboard/agent_collapsed_tiles_test.go
#10613	✨ dashboard: Review Queue collapsed row shows a priority-split history sparkline	same files	src/pkg/dashboard/static/index.html
#10638	🐛 dashboard: Overview open-issue/PR totals explain their gap to the forge counts	same files	src/docs/scale-envelope.md src/pkg/dashboard/static/index.html src/pkg/github/client.go
#10619	✨ dashboard: move project actions to toolbar	same files	src/pkg/dashboard/static/index.html
#10618	✨ Improve collapsed Advisory and ACMM headers	same files	src/pkg/dashboard/static/index.html

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Test coverage note (non-blocking): the new markReporterTrustAwaiting tests cover the notice/label audits, the per-poll budget, and the cleared audit — nice. The one new branch without a test is the comment-failure path in reporter_trust_wait.go:

if err := c.CreateIssueComment(...); err != nil {
    ... RemoveLabel cleanup ...
    return   // new: skips AuditActionReporterTrustWaitNoticed
}

Neither the base nor this PR exercises CreateIssueComment returning an error, so nothing asserts (a) the just-added label is removed again and (b) no reporter_trust_wait_noticed audit is recorded on a failed comment. A TestEnumerateActionable_ReporterTrustWaitCommentFailureRollsBackLabel using the same newTestServer with a 500 on POST /issues/{n}/comments would pin both, and it's the branch most likely to regress silently (a half-applied label with no explanation comment is exactly what the audit trail is meant to catch). Fine as a follow-up if you'd rather keep this PR scoped.

---

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the diff against v5 plus the callers (client.go EnumerateActionable/fetchIssues, write_surface.go recordWriteAudit). The change looks correct to me:

• reporterTrustWaitBudget.reserve() (src/pkg/github/reporter_trust_wait.go:26-35) is nil-safe and fails open, and the budget is only consumed after the existing-marker scan, so already-noticed issues don't burn it.
• recordWriteAudit returns early on a nil receiver (src/pkg/github/write_surface.go:216), so the (*Client)(nil) test paths stay safe.
• The new return after a failed comment post (reporter_trust_wait.go:145) correctly keeps reporter_trust_wait_noticed from being recorded when the label was rolled back.

Two things for the maintainer, neither a defect in this diff:

1. Merge-order conflict with #10594. That PR adds reporter_trust_wait_cover_test.go which calls markReporterTrustAwaiting with the old 5-arg signature (its lines 136, 137, 281, 311). This PR adds a 6th budget parameter. Git will merge both cleanly, but pkg/github tests stop compiling once both are in. Whichever lands second needs a one-line rebase (passing nil for the budget fails open, per reserve()).
2. The title/body say the wait comment and label mutations are routed through the effects-backed path, but AddLabels/RemoveLabel/CreateIssueComment were already effects-backed on v5 (client.go:2196 effects.Execute), and this diff doesn't touch those calls. What it actually adds is the per-poll notice cap and the audit records — worth saying so in the body so the changelog fragment is accurate.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Conclusion: the reporter-trust budget + audit changes look correct to me, but the diff carries two changes the body does not mention — one of them reverts behaviour merged two hours earlier — and it will not compile together with #10594. Recommend the author trim this to its stated scope before a maintainer decides; I have not changed anything.

1. Undisclosed revert of #10587 — src/pkg/hub/stable_promotion.go:252-256 (medium).
This PR deletes the ghcrTagGeneration / stablePromotionEligibleBuild consult that #10587 ("make stable chase candidate by 24 hours", merged today 15:20Z) added to stableNextPromotionAt, so the function falls straight back to stablePromotionEligibleAt(candidate.CommittedAt). Mechanism: the hub's "next stable promotion" time stops reflecting the live stable generation and reports the candidate-soak estimate instead — exactly what #10587 changed on purpose. #10612 fixes the same flaky TestStableNextPromotionAtUnknownWhenNothingQueued by stubbing the two hooks in the test, keeping the production behaviour. If the revert is intentional, it needs to be stated and probably its own PR; if it was a merge/cherry-pick artifact, drop the hunk.

2. Undisclosed regexp rewrite — src/pkg/dashboard/feedback.go:80, src/pkg/hub/feedback.go:378 (low).
Not in the body. This is now the fourth open PR rewriting these two lines (#10612, #10617, #10594 each use a different pattern). This one, ^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\[bot\])?$, keeps the 39-char cap but accepts consecutive hyphens (oc--to matches — I ran it), which GitHub logins do not allow and the original lookahead was there to prevent. Consequence is only a bad @mention, but it is a regression relative to the intended rule. Suggest dropping this hunk and letting one of the dedicated PRs own it (#10594's len(base) <= 39 && ^[A-Za-z0-9](?:-?[A-Za-z0-9])*$ is the only one that gets both the cap and the hyphen rule right).

3. Compile conflict with #10594. This PR changes markReporterTrustAwaiting to take a *reporterTrustWaitBudget (src/pkg/github/reporter_trust_wait.go:105) and fetchIssues likewise (client.go:1103). #10594's new reporter_trust_wait_cover_test.go calls the five-argument form in several places (e.g. its lines 797, 942, 972). Whichever merges second breaks go build ./pkg/github/.... Since #10594 exists to restore the github coverage floor, the natural order is #10594 first, then rebase this and update those call sites.

What I verified as correct: reporterTrustWaitBudget.reserve() is nil-safe and is consulted after the existing-comment check (reporter_trust_wait.go:115-123), so re-polls of already-noticed issues do not burn budget; the comment-failure path now returns before recording reporter_trust_wait_noticed (line 145), and the label is rolled back first. recordWriteAudit, hiveWriteMeta, AuditActionHiveLabelApplied all exist on v5 (write_surface.go:215, write_surface_internal.go:30,57).

Question for a maintainer: is dropping #10587's live-generation consult in stableNextPromotionAt intended?

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Shared CI incident: the red checks on this PR (docker (hive), overlayfs-exec-guard, golangci-lint, relative links and anchors resolve, pkg/dashboard/pkg/hub test shards incl. TestAgentsCollapsedSummaryRendersPerAgentTiles / TestOpenAPISpecCoversEveryRegisteredRoute) are the v5 baseline breakage tracked in #10623, not this diff. Fix is carried by #10612; this PR is deferred until it lands, then needs a v5 merge/re-run. PR-local extra: webstatic.TestStyleRatchet (operator index.html 230 raw paddings > 229) comes from this branch's older merge-base — merging current v5 clears it.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Conclusion: the reporter-trust change itself reads correctly, but this branch carries unrelated v5 baseline-repair hunks that now conflict with v5 HEAD (#10617 merged at 16:43Z) and with the open #10612. Recommend rebasing onto current v5 and dropping everything outside pkg/github + its docs before this is merged.

What I verified in the core change (src/pkg/github/reporter_trust_wait.go, client.go, write_surface_internal.go):

• reporterTrustWaitBudget is created once per EnumerateActionable (client.go:1015) and threaded into fetchIssues → markReporterTrustAwaiting; reserve() is called only after the existing-comment check (reporter_trust_wait.go:115-118), so already-noticed issues don't burn budget. Nil-budget path returns true. Looks correct to me.
• The new audit actions are added to InternalWriteAuditActions() (write_surface_internal.go:80-81), and the comment-failure path now returns before recording reporter_trust_wait_noticed (:145), which is the right ordering.

Out-of-scope hunks that will bite on merge (branch diverged from v5 at 9741881, 3 behind):

1. src/pkg/dashboard/feedback.go and src/pkg/hub/feedback.go — this PR rewrites the login regexp to ^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\[bot\])?$. v5 HEAD already has #10617's ^[A-Za-z0-9](?:-?[A-Za-z0-9])*… on the same line (dashboard/feedback.go:85, hub/feedback.go:382), so this is a textual conflict. Note the two are not equivalent: this PR's version accepts a--b (the [A-Za-z0-9-]{0,37} run permits consecutive hyphens, which GitHub rejects); #10617's does not. If the conflict is resolved in favour of this branch it is a small regression. Resolution should be: take v5's side and drop these two hunks.
2. src/pkg/hub/stable_promotion.go:252-256 — removes the ghcrTagGeneration/stablePromotionEligibleBuild lookup from stableNextPromotionAt. That changes runtime behaviour of stable-promotion scheduling, not reporter trust, and #10612 solves the same test-hermeticity problem by stubbing the var in the test instead. Both cannot land as-is; a maintainer should pick one approach.
3. src/pkg/dashboard/static/index.html, webstatic/style_ratchet_test.go, agent_collapsed_tiles_test.go, dashboard/openapi.json — #10612 touches the same four files with different hunks (e.g. this PR tokenizes .gov-agent-name-link/.config-tabs/.dashboard-grip padding; #10612 tokenizes .prt-role-select). These are competing baseline repairs, not duplicates.

Body vs diff: the body's bullets (budget, audit records, Hive-owned label clearing, docs) match the pkg/github diff. The body does not mention items 1–3 above, which is how I'd expect merge-base drift to look — the fix is a rebase, not a redesign.

Routing: @clubanderson (author) for the rebase; whoever owns stable-promotion for item 2. I have not changed anything on this PR.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback